Which could get confusing.
And to be fair, one of them isn't so much of a password
As a "token"
Need to make the password/account policy stuff to handle that
IIRC there is an account policy issue already open if you want to brain dump some of your ideas there later?
I wonder if I can make a hook that checks if a package I'm about to build does it so I can fix it myself first.
it's optional
Survey completed. Could you let us know if the results are available?
@trissylegs are you still struggling with Pam to login? Did not fully get it here. I had a quick look into your system-auth and think Pam_kanidm.so was missing in the session section. If you want I can share mine, also using Arch.
Best wishes
Best wishes
1 reply
just to be sure it gets plenty of time etc.
So today I got a new SSD and I formatted it with ZFS. ZFS has good subvolumes (named datasets). You can set an encryption key per dataset. So I made my home directory a dataset and set a passphrase key that matches my password.
Then did some PAM magic and now it will only decrypt my home directory on login.
https://blog.trifork.com/2020/05/22/linux-homedir-encryption/
They mention that you can't login with public keys because ~/.ssh/authorized_keys is missing. But for kanidm that is fine. Because it get's the key from kanidm anyway. But, it won't have a password to decrypt the drive :/. I suppose the same goes for gnome-keyring. But that doesn't decrypt via ssh anyway (Probably for the same reason)
Then did some PAM magic and now it will only decrypt my home directory on login.
https://blog.trifork.com/2020/05/22/linux-homedir-encryption/
They mention that you can't login with public keys because ~/.ssh/authorized_keys is missing. But for kanidm that is fine. Because it get's the key from kanidm anyway. But, it won't have a password to decrypt the drive :/. I suppose the same goes for gnome-keyring. But that doesn't decrypt via ssh anyway (Probably for the same reason)
*today is now yesturday
Cool. I have zfs as well and was thinking of home encryption. But not yet dared to start it. 🤣
Same for gdm,it only shows local users. But it will show once the logged it. I did a bit of research, I think also related how sssd does it, it think this is a dbus issue or. Need to search again.
About my arch Pam. It was just a minimal change. Not as hardened as suggested by kanidm docs. Will share, once I am back at the machine.
Honestly, I'm probably just overly opinionated here but I think that most machines are single-user, not multi-user so the concept of per-home drive or per-user encryption doesn't make sense to me because there is a 1:1 with the user and the system, so system wide encryption maps to the user anyway
Arch wiki simplifies the above to just home drive. Which is basically what I have set up. (And my safety user users the the same password)
The setup above to me is just a nicer version because you get the login screen before needing to decrypt anything. Which is kinda how macOS does it
The setup above to me is just a nicer version because you get the login screen before needing to decrypt anything. Which is kinda how macOS does it
It's just the user pw + disk pw is bound together
You could do similar with luks if you wrote a pam module for it.
But it would have issues with remote pw's
But linux backup tools are a bit of a wasteland ....
Yeah, backups. I have recently switched to kopia and really like it. It's worth having a look, I would say.
My current backup is Déjà Dup to to my NAS and my NAS is using duplicacy [sic] to b2. Although I'm not happy with duplicacy
I was using duplicati which is AFAIK very similar to duplicacy. But was also not super happy. Finally I tried to restore from a different machine and this failed after 4 days and 3 retries. 😵
BTW kopia also supports b2 as storage backend
On home enc: yes mostly 1:1 true. But IMHO the super correct way of doing this would be per user home (i.e. zfs dataset)
I found some scripts doing this but have not tried so far.
I found some scripts doing this but have not tried so far.
@georg.hofmann:matrix.org But per-user home implies a multi-user machine, and that's really rare. These days most computers 1 to 1 map from their own to the only user on that system.
Similar to phones/tablets
Main Multi-user PC I've used is was the family PCs. Now I don't think many families do that much... and they're probably not using per-user disk encryption
it's free if you don't want all the management ooling